fix(datacell, odescent): fix multiple out-of-bounds array accesses

[LHT129]

Summary

Fix three out-of-bounds array/vector accesses in src/:

• src/datacell/graph_datacell.h: DeleteNeighborsById / RecoverDeleteNeighborsById use id <= max_capacity_, allowing id == max_capacity_ which is one past the end of node_versions_.
• src/impl/odescent/odescent_graph_builder.cpp: ODescent::repair_no_in_edge reads link[need_replace_loc] and graph_[...].neighbors[replace_pos[...]] without verifying the post-update_neighbors actual container sizes.
• src/datacell/sparse_term_datacell.cpp: SparseTermDataCell::DocPrune accumulates sorted_base[i].second until temp_mass >= part_mass; floating-point error near doc_retain_ratio_ = 1.0 can push pruned_doc_len past the end.

All changes are minimal boundary-condition fixes and do not affect normal-path behavior.

Fixes #2363

Changes

src/datacell/graph_datacell.h                | 4 ++--
src/datacell/sparse_term_datacell.cpp        | 2 +-
src/impl/odescent/odescent_graph_builder.cpp | 6 +++++-
3 files changed, 8 insertions(+), 4 deletions(-)

Verification

• make fmt passes.
• Source files end with newlines.
• One signed-off-by commit on top of github/main.

(Build/Test steps skipped on operator instruction due to local environment limitations; reviewers are asked to run CI.)

[mergify]

Merge Protections

🟢 All 3 merge protections satisfied — ready to merge.

Show 3 satisfied protections

🟢 Require kind label

• label~=^kind/

🟢 Require version label

• label~=^version/

🟢 Require linked issue for feature/bug PRs

• body~=(?im)(?:^|[\s\-\*])(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:#\d+|[\w.\-]+/[\w.\-]+#\d+|https?://github\.com/[\w.\-]+/[\w.\-]+/issues/\d+)

[gemini-code-assist]

Code Review

This pull request introduces critical bounds checks to prevent potential out-of-bounds accesses in GraphDataCell, SparseTermDataCell, and ODescent. In odescent_graph_builder.cpp, the proposed check for replace_pos can be improved; instead of skipping the repair entirely when the index is out of bounds, capping the index to the maximum valid neighbor list size allows the repair logic to continue functioning correctly.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR fixes three boundary-condition out-of-bounds array/vector access bugs in the C++ src/ implementation (GraphDataCell delete/recover, ODescent graph repair, and SparseTermDataCell doc pruning), aligning behavior with the intended container bounds and eliminating undefined behavior paths described in issue #2363.

Changes:

• Fix an off-by-one capacity check in GraphDataCell::{DeleteNeighborsById, RecoverDeleteNeighborsById} (<= → <).
• Add post-update_neighbors() size guards in ODescent::repair_no_in_edge() to avoid indexing beyond actual neighbor list lengths.
• Bound SparseTermDataCell::DocPrune()’s accumulation loop to prevent walking past sorted_base.size().

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/datacell/graph_datacell.h	Tightens ID bound checks to prevent OOB access to node_versions_ on the capacity boundary.
src/impl/odescent/odescent_graph_builder.cpp	Adds container-size-based guards in repair_no_in_edge() to prevent OOB reads after neighbor list compaction.
src/datacell/sparse_term_datacell.cpp	Adds loop bound in DocPrune() so pruning cannot read past the end of sorted_base.